Welotec TK Series CVE-2026-109161

Exploitation requires an attacker to already possess high-privilege access to the device (CVSS PR:H) and to reach the Digital I/O function over the network (AV:N/AC:L, no user interaction). The specific vulnerable component is the Digital I/O function of Welotec TK100, TK500-v2, and TK500-v3 devices; the precise malformed-input format that overflows the bounds check is not described in the available sources. The principal limiting factor is the high-privilege authentication requirement, which restricts this to insiders or attackers who have already compromised privileged credentials; impact is confined to availability (service crash/DoS) with no confidentiality or integrity effect.

This is a moderate-severity denial-of-service issue (CVSS 4.0 base 6.9) affecting Welotec TK100/TK500-v2/TK500-v3 industrial routers, reported by CERT@VDE (advisory VDE-2026-119). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H) signals a network-reachable, low-complexity attack but one that requires high privileges (PR:H) and yields availability impact only - no confidentiality or integrity loss. No EPSS score was supplied, the CVE is not on CISA KEV, and no proof-of-concept or exploit reference is present in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (routine prioritization), not act_now or emergency, which is consistent with the PR:H precondition and availability-only impact. The practical risk driver here is the operational context: these are industrial/OT networking devices where a DoS can disrupt connectivity, but the requirement for an already-high-privileged account substantially narrows the realistic attacker set. Note that EPSS is absent (not an error, but it limits quantitative exploitation-likelihood comparison), and the attacker already needs high privileges, so this is better treated as a scheduled-patch item than an urgent, mass-exploitation threat.

An attacker who already holds a high-privilege account on a Welotec TK100 or TK500 device sends input to the Digital I/O function that exceeds the expected bounds, triggering the insufficient bounds check (CWE-120) and crashing the affected service. Because the CVSS vector is AV:N/AC:L, this can be done over the network with low complexity, but PR:H means valid high-privilege credentials or session access are a prerequisite. No public proof-of-concept or exploit code is referenced in the available sources.